DG2 Design targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: United States
• Sector: Financial Services
• Announcement date: April 1, 2025

Anubis ransomware group claims data breach at DG2 Design

The Anubis ransomware group has published an announcement on its leak site, claiming to have obtained sensitive data belonging to DG2 Design. According to the claim, the threat actor gained unauthorized access to the company's internal data. To substantiate these claims, the group has provided samples of technical drawings and project documents to the public.

Ransomware attacks often involve a technique known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information. By threatening to leak this stolen data on a public leak site, the threat actors attempt to pressure the victim into paying a ransom. In this specific instance, the group has listed DG2 Design as a victim, though information regarding the specific capabilities and identity of the Anubis group remains limited.

Details of the alleged data theft

The data allegedly stolen by the Anubis group includes a variety of sensitive documents and technical files. The information provided in the leak samples suggests a significant breach of proprietary and private information. The contents of the leak reportedly include:

• Personal data
• Contracts
• Architectural blueprints

The samples released by the threat actor contain specific architectural and landscape plans. Notably, these documents appear to be related to entities such as M1 Bank and Mastercard, indicating that the breach may impact the privacy and security of the organization's high-profile clients and business partners.

Potential risks and implications

The alleged data leak poses several significant risks to DG2 Design and its associated third parties. The exposure of architectural blueprints, particularly those belonging to financial institutions, could potentially lead to physical security vulnerabilities. When detailed layouts and technical plans of secure facilities are made public, it may create opportunities for physical breaches or targeted attacks against those locations.

Furthermore, the exposure of personal data and contracts may trigger legal proceedings under relevant state laws and data protection regulations, as the company is based in the United States. The company and its partners may also face an increased risk of targeted phishing attacks, as stolen information is frequently used by cybercriminals to craft highly convincing social engineering campaigns.

Beyond the immediate privacy concerns, the organization may face secondary risks, including the loss of intellectual property and significant damage to its commercial reputation. For organizations in the design and architectural sectors, the protection of blueprints is critical to maintaining competitive advantages and client trust.

Defensive considerations for organizations

While the specific details of the attack remain limited to the group's claims, organizations can generally mitigate such risks by implementing robust security frameworks. This includes maintaining strict access controls to sensitive project files, implementing multi-factor authentication across all systems, and conducting regular audits of data access logs. Additionally, monitoring for unauthorized data exfiltration and ensuring that architectural plans are encrypted both at rest and in transit can help reduce the impact of a potential breach. Organizations should also focus on employee training to recognize phishing attempts, which often follow the exposure of sensitive corporate data.